| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| A heap buffer overflow in r_read_le32 function in radare25.4.2 and 5.4.0. |
| A use after free in r_reg_get_name_idx function in radare2 5.4.2 and 5.4.0. |
| A null pointer deference in __core_anal_fcn function in radare2 5.4.2 and 5.4.0. |
| A heap buffer overflow in vax_opfunction in radare2 5.4.2 and 5.4.0. |
| A heap buffer overflow in r_sleb128 function in radare2 5.4.2 and 5.4.0. |
| An incorrect access control issue in Sandboxie Classic v5.55.13 allows attackers to cause a Denial of Service (DoS) in the Sandbox via a crafted executable. |
| Simple Bakery Shop Management System v1.0 contains a file disclosure via /bsms/?page=products. |
| Car Rental System v1.0 contains an arbitrary file upload vulnerability via the Add Car component which allows attackers to upload a webshell and execute arbitrary code. |
| SQL Injection vulnerability in Victor CMS v1.0, via the user_name parameter to /includes/login.php. |
| Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \backend\database_controller.php. |
| Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \backend\file_controller.php. |
| ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php. |
| Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function. |
| Improper sanitization of trigger action scripts in VanDyke Software VShell for Windows v4.6.2 allows attackers to execute arbitrary code via a crafted value. |
| Typemill v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the upload function. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. |
| Directory Traversal vulnerability in file cn/roothub/store/FileSystemStorageService in function store in Roothub 2.6.0 allows remote attackers with low privlege to arbitrarily upload files via /common/upload API, which could lead to remote arbitrary code execution. |
| The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allows an attacker to inject malicious javascript code. |
| NGINX NJS 0.7.2 was discovered to contain a NULL pointer dereference via the component njs_vmcode_array at /src/njs_vmcode.c. |
| STB v2.27 was discovered to contain an integer shift of invalid size in the component stbi__jpeg_decode_block_prog_ac. |
| Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control. |
